CVE-2019-7250

An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code via SCRIPT elements, event handlers, etc.. Since this code...

PT-2019-18480

Name of the Vulnerable Software and Affected Versions Cross Reference Add-on version 36 for Google Docs Description An issue in the Cross Reference Add-on allows stored XSS in the preview boxes of the configuration panel. A malicious user can inject arbitrary JavaScript code using SCRIPT elements...